For the purpose of the General Data Protection Regulations (GDPR) 2018, the data controller is Magna Vitae, Unit 10, Fairfield Enterprise Centre, Lincoln Way, Fairfield Industrial Estate, Louth, Lincolnshire, LN11 0LS.
Magna Vitae is a registered charity (charity number 1160156).
This policy (together with our Terms and Conditions of use and any other documents referred to in this policy) explains how we will collect, process, use and protect any personal data which we collect from you or that you provide. It applies to information we collect about:
- visitors to our website and social media feeds;
- people who use our services;
- job applicants and our current and former employees;
- complaints, comments and suggestions; and
- any other services we may provide.
- Collect the information fairly;
- Let you know how we will use it; and
- Keep the information secure.
What is personal information?
Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details.
Some of your personal information might be ‘special’
Some information is ‘special’ and needs more protection due to its sensitivity. It’s often information you would not want widely known and is very personal to you. This is likely to include anything that can reveal you’re:
- physical or mental health
- trade union membership
- genetic/biometric data
- criminal history
Why do we need your personal information?
We may need to use some information about you to:
- deliver services and support to you;
- manage those services we provide to you;
- train and manage the employment of our workers who deliver those services;
- help investigate any worries or complaints you have about your services;
- keep track of spending on services;
- check the quality of services; and
- to help with research and planning of new services.
Information we collect from you
We collect and process the following data about you via the following means:
- Information you provide in applying for our services such as membership applications, theatre ticket purchases, holiday activity registration, Boditrax registration, swimming lesson (WaterWise) registration, course registration, employment application and expression of interest in our services.
- Information that you provide by filling in forms on our website magnavitae.org, www.embassytheatre.co.uk and www.sofestival.co.uk includes information provided at the time of registering to use our site, subscribing to any service, posting material or requesting further services. We may also ask you for information when you report a problem with our site. If you contact us, we may keep a record of that correspondence. We may also ask you to complete surveys that we use for research or improvement purposes or for satisfaction surveys, although you do not have to respond to them.
Basis for Processing of Data
Magna Vitae process data in accordance with the following articles:
- 6(1)(a) Consent of the data subject; and
- 6(1)(b) Processing is necessary for the performance of a contract with the data subject or to take steps
to enter into a contract.
Where we store your personal data
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website or booking systems, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website. Any transmission is therefore at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Our theatre booking systems (Spektrix & Artifax) are cloud based systems hosted by a third party in the UK. We have a data sharing agreement in place to ensure that your data is held securely and will not be shared with any other party.
Our leisure venue booking and customer management system (Gladstone MRM) is maintained by Magna Vitae staff and is held on servers managed by Compass Point Business Services (CPBS) a UK based company with whom we have a data sharing agreement to ensure your data is held securely and is not shared with any third party.
The Boditrax system is a hosted cloud based system which is operated by Boditrax, a UK based company with whom we have an information sharing agreement to ensure your data is held securely and is not shared with any third party.
We use information held about you in the following ways
- To ensure that our services are presented in the most effective manner for you;
- To provide you with information, products or services that you request from us or which we feel may be of interest to you, where you have consented to be contacted for such purposes;
- To carry out our obligations arising from any membership contracts entered into between you and us;
- To allow you to book our services;
- To notify you about changes to our service; and
- To produce statistical information.
Disclosure of your information
We will not disclose your information to any third parties unless we have your permission to do so, or are required to by law or in order to comply with any contractual agreements you have entered into.
- The right to be informed;
- The right of access;
- The right to rectification;
- The right to erasure;
- The right to restrict processing;
- The right to data portability;
- The right to object; and
- Rights in relation to automated decision making and profiling.
You also have the right to ask us not to process your personal data for marketing purposes. You can exercise your right to allow such processing by checking certain boxes on the forms we use to collect your data.
You can exercise the above rights at any time by contacting us at email@example.com
When someone visits www.magnavitae.org.uk, www.embassytheatre.co.uk and www.sofestival.co.uk we use a third party service, such as Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow the third party service to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will make this very clear. We will make it clear when we collect personal information and will explain what we intend to do with it. Our website may, from time to time, contain links to and from the websites of our partner networks and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for those policies or websites. Please check those policies before you submit any personal data to any of those websites.
We use a third party provider to deliver our monthly e-newsletter. We gather statistics about email opening and ‘clicks’ using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.
Security and performance
Magna Vitae uses a third party service (LaserRed) to help maintain the security and performance of our websites. To deliver this service it processes the IP addresses of visitors to the Magna Vitae websites.
Our website Customer Relationship Management (CRM) is provided by a third party service, WordPress.
Nominated Magna Vitae staff monitor and respond to feedback and comments on our Facebook and Twitter feeds. We use a third party provider (Hootsuite) to manage our social media interactions. If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations.
Magna Vitae use a third party provider, Compass Point Business Services (CPBS) to provide its email infrastructure. Any email sent to us, including any attachments, will be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software (Mimecast) may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
When we receive a complaint from a person we construct a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.
We may have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant does not want information identifying him, or her, to be disclosed they must tell us and we will try to respect that. However, it may not be possible to effectively deal with a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
Job applicants, current and former employees
When individuals apply to work at Magna Vitae (or are Trustee applicants), we will only use the information they supply to us to process their application and to monitor recruitment statistics. Payroll and Human Resource services are provided by Compass Point Business Services and we will therefore share the information provided by candidates with them. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Disclosure and Barring Service (DBS) we will not do so without informing the candidate beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help monitor our recruitment activities, but no individuals are identifiable from that data.
Once a person has taken up employment with Magna Vitae, we will compile a personal file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Magna Vitae has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it (or shred where held as hard copy)
Access to personal information and contact details
Magna Vitae tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘Subject Access Request’ under GDPR 2018 if we do hold information about you we will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please email or write to us at the address listed below. We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate. There is no charge for a copy of the data we hold about you. Data will be supplied within 40 calendar days from receipt of your request and validation of proof of identity.
How long do we keep your personal information?
There’s often a legal reason for keeping your personal information for a set period of time, we try to include all of these in our retention schedule which lists how long your information may be kept for. This ranges from months for some records to decades for more sensitive records.
The Data Protection Officer, Jonathan Hendry, Magna Vitae, Unit 10, Fairfield Enterprise Centre, Lincoln Way, Fairfield Industrial Estate, Louth, Lincolnshire, LN11 0LS.
Or email us at: firstname.lastname@example.org
You can also get further information on:
- Agreements we have with other organisations for sharing information;
- Circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
- Our instructions to staff on how to collect, use and delete personal data;
- How we check that the information we hold is accurate and up to date; and
- Links to other websites.
For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:
Information Commissioner's Office
Cheshire SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
This privacy notice was last updated on: 26.02.2018